Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 19:39 UTC
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll
-
Size
171KB
-
MD5
d66afafdc9ad8cc4135e1bab32cb0cdd
-
SHA1
e0550c10cb1b616fcc44f2cdeef8c6379192abda
-
SHA256
07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1
-
SHA512
7a264f9e00b565c8c60201ef02aaddb10a82481efd9515989c6f676f5bba4276958351541dd15efd1f8c0847d489281e4cf878e1af653ec36f8032886f9e0e73
-
SSDEEP
3072:oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:oH9RVaPEmsdHdbQUbd2H3
Malware Config
Extracted
dridex
22201
128.199.200.38:443
192.163.233.216:6601
43.229.206.244:4125
Signatures
-
Dridex family
-
resource yara_rule behavioral2/memory/5024-1-0x0000000074D80000-0x0000000074DB0000-memory.dmp dridex_ldr behavioral2/memory/5024-2-0x0000000074D80000-0x0000000074DB0000-memory.dmp dridex_ldr -
Program crash 1 IoCs
pid pid_target Process procid_target 448 5024 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4452 wrote to memory of 5024 4452 rundll32.exe 83 PID 4452 wrote to memory of 5024 4452 rundll32.exe 83 PID 4452 wrote to memory of 5024 4452 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 6643⤵
- Program crash
PID:448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5024 -ip 50241⤵PID:968
Network
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.190.18.2.in-addr.arpaIN PTRResponse196.190.18.2.in-addr.arpaIN PTRa2-18-190-196deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request134.130.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
133.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
196.190.18.2.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
134.130.81.91.in-addr.arpa
-
210 B 133 B 3 1
DNS Request
88.210.23.2.in-addr.arpa
DNS Request
88.210.23.2.in-addr.arpa
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa